I need to draw a chart with 2 values on x-axis , how to do that?
Herby the code sample that i'm using:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Web Services Trends</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Sum of Claims" autoRun="True">
<param name="savedSearch">RELEASECHECK2</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<option name="charting.axisX">time</option>
<param name="charting.axislabelsX.majorUnit">RELEASEDATE</param>
<param name="charting.axislabelsX.minorUnit">RELEASENAME</param>
<param name="charting.axislabelsY.majorUnit">data</param>
<param name="charting.axislabelsY.minorUnit">data</param>
<!--
<param name="layout.axisLabelsX.minorTickVisibility">yes</param>
<param name="layout.axisLabelsX.majorTickVisibility">yes</param>
-->
<option name="charting.axisX.comparator">RELEASENAME</option>
<param name="primaryAxisTitle.text">x axis name</param>
<param name="secondaryAxisTitle.text">y axis name</param>
<module name="FlashChart"/>
</module>
</module>
</view>
That would be very cool if the charting framework could do that - if it could take two different fields RELEASEDATE and RELEASENAME, and use one for the major markers on the x-axis, and the other values for the minor-markers.
But I'm virtually certain that this is not possible. Someone else may surprise us here - it wouldn't be the first time that awesome functionality was deeply buried in the Splunk charting framework.
The good news is that I think you can get what you want by exploring charts like:
foo | chart count over RELEASEDATE by RELEASENAME
and then graph that as a column chart. If you'd rather have the column bars stacked above eachother within a given RELEASEDATE, you can set charting.chart.stackMode
to stacked
.
NOTE: you're mixing simple-xml syntax inside your HiddenChartFormatter. Surprisingly I think the advanced XML wont throw any error, but it will be totally ignoring those <option>
nodes. Replace them with equivalent <param>
nodes if you want them to be used.